diff --git a/loader/LibExt/LIBExt_src/Ctrl_Flow/bl_func.c b/loader/LibExt/LIBExt_src/Ctrl_Flow/bl_func.c
index dc1caff95..bcf7c3a6e 100755
--- a/loader/LibExt/LIBExt_src/Ctrl_Flow/bl_func.c
+++ b/loader/LibExt/LIBExt_src/Ctrl_Flow/bl_func.c
@@ -2065,46 +2065,48 @@ _THUMB2 static int bl_load_uboot_from_flash(unsigned char *p_fdt, unsigned char
 //		debug_err_var("OtaFlag=", info->OtaFlag);
 		return 0;
 	}
+/* assume ota_flag is read from partition_sys and in the first word */
+_THUMB2 static UINT32 bl_check_ota_flag(UINT32 buf_fdt, UINT32 buf_size)
+{
+    int er;
+    unsigned char *p_fdt = NULL;
+    DRAM_PARTITION *p_dram_partition = NULL;
+    unsigned char *p_tmp = (unsigned char *)SDRAM_Start_FW;
 
-	/* assume ota_flag is read from partition_sys and in the first word */
-	_THUMB2 static UINT32 bl_check_ota_flag(void)
-	{
-		int er;
-		unsigned char *p_fdt = NULL;
-		DRAM_PARTITION *p_dram_partition = NULL;
-		unsigned char *p_tmp = (unsigned char *)SDRAM_Start_FW;
+    // open flash
+    if (bl_flash_open() != 0) {
+        debug_msg("flash open failed\r\n");
+        return 0;
+    }
 
-		// open flash
-		if (bl_flash_open() != 0) {
-			debug_msg("flash open failed\r\n");
-			return 0;
-		}
+#if (FDT_SUPPORT)
+    // load fdt
 
-	#if (FDT_SUPPORT)
-		// load fdt
-		er = bl_load_fdt_from_flash(p_tmp, SDRAM_Start_FW, &p_fdt); // dtb size less than 32MB to be safer.
-		if (er != 0) {
-			debug_err("load fdt failed\r\n");
-			return 0;
-		}
-	#endif
+    debug_msg_var("buf_fdt=", buf_fdt);
+    debug_msg_var("buf_size=", buf_size);
+    er = bl_load_fdt_from_flash((unsigned char *)buf_fdt, buf_size, &p_fdt); // dtb size less than 32MB to be safer.
+    if (er != 0) {
+        debug_err("load fdt failed\r\n");
+        return 0;
+    }
+#endif
 
-		p_dram_partition = (DRAM_PARTITION *)bl_get_fdt_cfg(p_fdt, MODELEXT_TYPE_DRAM_PARTITION);
-		if (p_dram_partition == NULL) {
-			debug_err("null p_dram_partition\r\n");
-			return 0;
-		}
+    p_dram_partition = (DRAM_PARTITION *)bl_get_fdt_cfg(p_fdt, MODELEXT_TYPE_DRAM_PARTITION);
+    if (p_dram_partition == NULL) {
+        debug_err("null p_dram_partition\r\n");
+        return 0;
+    }
 
-		if(bl_load_sys_from_flash((unsigned char *)p_dram_partition->fdt_addr, p_tmp)){
-			debug_err("bl_load_sys_from_flash failed\r\n");
-			return 0;
-		}
+    if(bl_load_sys_from_flash((unsigned char *)p_dram_partition->fdt_addr, p_tmp)){
+        debug_err("bl_load_sys_from_flash failed\r\n");
+        return 0;
+    }
 
-		UINT32* ota_flag = (UINT32*)p_tmp;
-		debug_msg_var("ota_flag=", *ota_flag);
+    UINT32* ota_flag = (UINT32*)p_tmp;
+    debug_msg_var("ota_flag=", *ota_flag);
 
-		return (*ota_flag);
-	}
+    return (*ota_flag);
+}
 #endif
 	/***********************************************************************************/
 
@@ -3129,7 +3131,8 @@ _THUMB2 UINT32 bl_mainFlow(void)
 	UINT32 uiTmpBufferAddr            = uiheapBufferAddr + FAT_HEAP_BUFFER_SIZE;
 	UINT32 uiUpdateBootloaderBufAddr  = uiTmpBufferAddr + 0x4000;
 	UINT32 uiUpdateMainBinBufAddr     = SDRAM_Start_FW;
-
+    UINT32 uiOTABufferAddr     = uiUpdateBootloaderBufAddr + 0xA000;
+    UINT32 uiOTABufferSize     = 0x10000 * 2; /* 2 blks */
 	// UART initial sequence
 	//uart_openSystemUART();
 	// rtc reset shutdown timer
@@ -3215,7 +3218,7 @@ _THUMB2 UINT32 bl_mainFlow(void)
 	UINT32 ota_flag = 0;
     if(gsfSpecialKeyCallBack(0))
     {
-        ota_flag = bl_check_ota_flag();
+        ota_flag = bl_check_ota_flag(uiOTABufferAddr, uiOTABufferSize);
     }
 
 #if !(USB_WRITELOADER || UART_UPDATE)
@@ -3299,15 +3302,19 @@ _THUMB2 UINT32 bl_mainFlow(void)
 						if (bl_load_rtos_from_non_nvtpack(uiUpdateMainBinBufAddr, uiUpdateFileLen, &adjusted_addr, &adjusted_size) == 0) {
 							uiFwBaseAddr = adjusted_addr; //fix compressed fit bl_checkDramScanFW() after copy its to temp area, see commit log
 							uiUpdateFileLen = adjusted_size;
-						} else {
-							bl_displayErrMsg("invalid firmware");
-						}
+
 #if UPDATE_EMU_CODE
 						uiLoaderFunc |= FUNC_UPDATE_FW;
 #else
 						uiLoaderFunc |= FUNC_RUN_CARD;
 #endif
 
+						} else {
+							debug_err("invalid firmware");
+							uiLoaderFunc |= FUNC_RUN_FLASH;
+						}
+
+
 					}
 					fat_close_rootfile();
 					debug_msg("\r\n"); // for line end RRRRRRR....